PHP2Shell vulnerabilities found by AI take down government websites in multiple countries

On the evening of October 21, if you have a habit of surfing social media, you might have noticed a strange wave of website shutdowns: almost at the same time, various critical infrastructure websites in multiple countries and regions around the world announced temporary closures.

Wednesday. The Finnish government shut down all of its external network services; the Dutch National Cyber Security Centre even took down its own official website, followed by the Port of Rotterdam, the Dutch Football Association, the websites of five major political parties, and several hospitals; the French Ministry of the Interior had provincial government websites temporarily taken offline, the German federal IT service provider shut down multiple sites, and the Belgian Ministry of Foreign Affairs, the Wikimedia Foundation, and Nintendo also successively suspended some services.

The Dutch government announced the preventive takedown of websites including DigiD | Image source: Rijksoverheid

But these websites were not actually hacked; they were proactively shut down by their own operators.

The reason was two vulnerabilities in PHP: PHP is the most widely used website backend language in the world, and according to W3Techs statistics, about 70% of websites whose backend language can be identified run on it. These two vulnerabilities are collectively called PHP2Shell, and attackers may be able to remotely control an entire server without needing to log in.

However, AI finding vulnerabilities is long since not news. But according to public reports so far, this is the first time that a vulnerability dug up by AI has caused governments in several countries to shut down their own websites on the same day. What it truly declares the end of is a rule in cybersecurity that was never written into textbooks but has always been in effect: many vulnerabilities are secure only because attacking them is too tiring.

PHP officially rated both vulnerabilities at 9.2 out of 10 for severity, and the security company watchTowr gave them a perfect score.

Both originate in PHP's lowest-level memory management and have nothing to do with whether a website's own code is well written. PHP's official statement is that all PHP that handles web requests is affected; Cloudflare says the affected versions trace all the way back to PHP 5.4 from more than a decade ago. Volker Dusch of the PHP Foundation compared it to 2014's "Heartbleed" and called it the most serious PHP security issue in more than a decade.

What made governments nervous was the chaotic 48 hours that followed: the vulnerabilities had originally been under embargo, and according to industry practice, the software vendor first prepares patches and then discloses them together with the discoverers.

But on October 20, someone released the news on Hacker News and the underground forum BreachForums, and watchTowr confirmed that day that the vulnerabilities were real. That evening, PHP officially urgently announced that the patch would be released one day early, at 14:00 (UTC) on the 21st.

Before the patch came out, attack attempts had already begun. Cloudflare CTO Dane Knecht said on X nearly six hours before the patch release, "We are seeing early attacks emerging." The recommendations from the U.S. National Security Agency, the UK National Cyber Security Centre, and the EU cybersecurity agency CERT-EU were almost identical: systems that cannot be patched in time should be taken offline first.

And so the scene at the beginning unfolded.

Three companies jointly disclosed this set of vulnerabilities | Image source: PHP2Shell

The ghost vulnerability returns

The most unusual thing about PHP2Shell is that it is not new; it was not even discovered just yesterday.

The first security company to discover it, Calif, traced its origins back to 2004 in a technical article. Twenty years ago, security researcher Stefan Esser had already found a similar problem in PHP when memory was exhausted. In 2020, someone submitted a related bug report, and almost no one paid attention; in 2024, a third-party-funded PHP security audit encountered related issues again, but because it could not prove they could actually be exploited, they were ultimately not fixed.

This vulnerability lay dormant in PHP for more than a decade, and more than once people came close to it, yet no one ever turned it into a real attack.

The 2020 bug report, which almost no one paid attention to | Image source: Calif

The reason was not that no one thought of it, but that it was too laborious. Independent author Nick Rogers said in an analysis article that turning this kind of vulnerability into a usable attack requires "weeks of tedious manual debugging," and in the past no one was willing to pay that cost. He gave this state a name: security by exhaustion, ensuring security by making attackers tired enough to give up.

A large amount of old code at the foundations of the internet exists in this strange yet awkward state. Theoretically there are vulnerabilities, but when it comes to actually attacking them, all sorts of experts feel it is too laborious, so they are simply left alone.

What changed this was a program OpenAI launched in June this year, "Patch the Planet": providing funding and models, and asking security companies to audit open-source software that the whole world depends on. Calif was one of the participants, and it set its target on PHP.

On August 1, Calif researcher Ryan Austin began an audit with AI. According to a technical article published by Calif, AI served as an "audit partner" and an agent in this audit: it combed through the PHP core code and traced the program's execution paths, and the key flaw in the first vulnerability was discovered by the agent in the core code. Just a few days after the audit began, the first problem surfaced.

On August 11, Calif reported the vulnerability to PHP: the team had AI summarize the "pattern" of the first vulnerability into a reusable skill file, specifically for hunting the same class of flaw. The second vulnerability was found with the help of this skill file.

Calif recreated the scene of the AI audit in a comic | Image source: Calif

Oh, and by the way, according to OpenAI's official blog post, Calif did not use specialized AI cyber offense and defense tools such as Daybreak this time, nor did it use frontier flagship models such as Astra, but rather a cheaper model like GPT-5.6 Sol.

At almost the same time, another security company, Wiz, ran into the same set of vulnerabilities. On August 19, Wiz researchers, using their own tool Wiz Atlas, Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol, independently discovered the first vulnerability. The next day, they verified remote code execution on Drupal; on the third day, they also verified it successfully on WordPress.

Wiz wrote in its blog that frontier models helped the team analyze the causes of failure and repeatedly adjust, making the attack work across multiple applications "within hours." Its conclusion was: "One researcher accomplished in a week what used to take a world-class team months." Wiz gave the greatest credit for this discovery to Gemini 4 Argon, and Raluca Ada Popa, Google DeepMind's head of Gemini security, also came out to say that this demonstrated "why frontier AI will change the landscape of cyber defense."

Two companies, three AI models, within three weeks, hit the same set of vulnerabilities from two directions. OpenAI and Google each emphasized their own model's contribution, which in itself shows that using AI to find vulnerabilities has become a track where leading AI companies compete head-on.

What AI has changed seems to be not just "whether it can be discovered," but more about "whether it is worth doing." When the cost of finding vulnerabilities, verifying them, and adapting attacks to different environments drops from "months for a top team" to "one person, one week," or even "a few hours," all those vulnerabilities that were previously deemed "too laborious to be worth it" become worth it. Rogers's phrasing is that AI, for the first time, has "pushed the marginal cost of cyberattacks toward zero."

This also explains why the two companies ran into the same set of vulnerabilities within three weeks. Calif specifically noted that when the vulnerabilities were first discovered, "no special tools were used, nor were models that ordinary people cannot access." If defenders can find it with publicly available models, attackers can do the same.

Putting PHP2Shell back into the past two years, one can see a fuse being gradually lit: in November 2024, Google announced that its AI project Big Sleep had found a previously unknown vulnerability in the database software SQLite, calling it the first time AI had found an exploitable vulnerability in widely used real-world software.

In April this year, Anthropic said that a preview version of Claude Mythos had found thousands of zero-day vulnerabilities in testing, including one in OpenBSD that had existed for 27 years. Because it was too capable, this model was not made public and was provided only to more than 40 organizations that maintain critical software.

In July, wp2shell, a chain of WordPress core vulnerabilities discovered by AI, was made public and subsequently exploited at scale by attackers.

From "can find them" to "making governments shut down sites" took two years | Image source: Geek Park

From "AI can find vulnerabilities," to "the vulnerabilities AI finds are too dangerous, so the model dare not release them," to "vulnerabilities found by AI made government websites shut down." AI's transformation of cybersecurity has, for the first time, gone from a technical news item inside the security circle to a reality that the whole society can feel.

As for the current situation, which is a complete mess, OpenAI also tried to save face in its blog post: the same capability that helps discover vulnerabilities "can also help attackers rapidly develop attack tools."

This is no longer a hypothetical. On the day PHP2Shell was made public, watchTowr researcher Jake Knott said that the attack attempts they observed on decoy servers used tools partly written with the help of AI. "So far no one has succeeded, but we don't think that will last long."

Over the past year, cases of attackers using AI have escalated rapidly. In November 2025, Anthropic disclosed that an organization it identified as having state backing used Claude Code to launch intrusions against about 30 targets, with 80% to 90% of the tactical operations in the attack carried out autonomously by AI.

In May of this year, Google's threat intelligence team reported that an attacker had used AI to develop a working zero-day exploit and planned to launch a large-scale attack, which Google stopped in advance; this is considered the first time an attacker successfully used AI to create a zero-day attack. John Hultquist, chief analyst at Google Threat Intelligence, said AI can not only review code at scale to find vulnerabilities, but also "produce working attacks, and that used to be a very high bar."

By September, in Anthropic's threat intelligence report, the cases had become scaled operations: an organization suspected of ties to Russian intelligence services used AI agents to automatically rewrite malware after security software raised alerts, with targets including more than 20 government departments and defense agencies; a group of Chinese-speaking operators used AI "agent clusters" for reconnaissance and vulnerability development, with one workflow producing more than a dozen suspected zero-days in a single month; and an independent hacktivist used AI to write a WordPress zero-day exploit and compromised at least 14 of 42 targets.

Anthropic's report said that AI has shifted the cost back onto defenders. In the past, launching a complex attack required a team; now one person plus a few AI agents is enough.

The defender's time window

On the day PHP2Shell was made public, OpenAI also offered a judgment: similar discoveries will increase sharply in the coming months.

Data is already confirming this. The day before PHP2Shell was disclosed, on October 20, Google released Chrome 156 stable, and this single version fixed 353 security vulnerabilities. A year earlier, Chrome 141 and 142 fixed 21 and 26, respectively.

In one year, the number of fixes in a single version rose more than tenfold | Image source: GeekPark

The list of reporters has changed too. Of the six highest-severity "critical" vulnerabilities in Chrome 156, four were reported by Anthropic researcher Xinyang Ge, one of which was explicitly labeled "assisted by Claude"; another came from OpenAI's Codex Security. The names of AI companies are now appearing in batches in the security advisories of the world's most widely used browser.

Six critical vulnerabilities, five reported by AI companies | Image source: GeekPark

The first reason for the sharp increase is that the method for finding vulnerabilities can now be replicated. The skill file in PHP2Shell is an example: in the past, the experience of a top security researcher was hard to replicate; now it can become a file and be handed to countless agents to run simultaneously.

In fact, the "stock" of vulnerabilities still waiting to be dug up on the internet is enormous. The foundation of the internet is old code accumulated over decades: PHP, browsers, operating systems, and various open-source libraries. How many vulnerabilities like PHP2Shell—ones that people had long brushed against but that were simply too hard to exploit—remain in this code is impossible to count. In the past they were protected by the fact that exploiting them was "too much work," and that protection is disappearing.

This is also why frontier AI research institutions are stepping up. Anthropic provided Mythos to more than 40 key software organizations, OpenAI committed $1 billion in equivalent usage credits to Patch the Planet, Google has Big Sleep, and Wiz this time also bet on Gemini. Leading AI companies have all made "using AI to find vulnerabilities" a main battlefield for demonstrating model capabilities. But don't forget: the AI in attackers' hands is often the same generation of models that defenders use.

OpenAI calls the period between the discovery of a vulnerability and attackers beginning to exploit it the "defender's window." PHP2Shell's window was originally more than two months, and a single early leak compressed it to a few hours.

AI has made finding vulnerabilities easier than ever, but patching still has to be done server by server. PHP released official fixes only for four versions, 8.2 through 8.5. According to statistics from the security firm Mallory, the day before the patch release, about 880,000 servers on the internet were still publicly showing PHP 8.1 or older versions. For them, the sense of security that "there is theoretically a vulnerability, but in practice no one will attack it" is gone.

*Header image source: Wiz

This article comes from the WeChat public account "GeekPark" (ID: geekpark), author: Zhang Yongyi, published by 36Kr with authorization.